config

type Incus struct {
	// UnixSocket is the path on disk to the Incus unix socket. If defined,
	// this is prefered over connecting via HTTPs.
	UnixSocket string `toml:"unix_socket_path" json:"unix-socket-path"`

	// Project name is the name of the project in which this runner will create
	// instances. If this option is not set, the default project will be used.
	// The project used here, must have all required profiles created by you
	// beforehand. For Incus, the "flavor" used in the runner definition for a pool
	// equates to a profile in the desired project.
	ProjectName string `toml:"project_name" json:"project-name"`

	// IncludeDefaultProfile specifies whether or not this provider will always add
	// the "default" profile to any newly created instance.
	IncludeDefaultProfile bool `toml:"include_default_profile" json:"include-default-profile"`

	// URL holds the URL of the remote Incus server.
	// example: https://10.10.10.1:8443/
	URL string `toml:"url" json:"url"`
	// ClusterURLs is the ordered, bounded failover set for the same Incus
	// cluster. It replaces URL after every member certificate is verified.
	ClusterURLs []string `toml:"cluster_urls" json:"cluster-urls"`
	// ClientCertificate is the x509 client certificate path used for authentication.
	ClientCertificate string `toml:"client_certificate" json:"client_certificate"`
	// ClientKey is the key used for client certificate authentication.
	ClientKey string `toml:"client_key" json:"client-key"`
	// TLS certificate of the remote server. If not specified, the system CA is used.
	TLSServerCert string `toml:"tls_server_certificate" json:"tls-server-certificate"`
	// TLSCA is the TLS CA certificate when running Incus in PKI mode.
	TLSCA string `toml:"tls_ca" json:"tls-ca"`

	// ImageRemotes is a map to a set of remote image repositories we can use to
	// download images.
	ImageRemotes map[string]IncusImageRemote `toml:"image_remotes" json:"image-remotes"`

	// SecureBoot enables secure boot for VMs spun up using this provider.
	SecureBoot bool `toml:"secure_boot" json:"secure-boot"`

	// WorkerImages is the exact flavor-to-image policy accepted from GARM.
	// Every configured alias resolves locally and is independently pinned by digest.
	WorkerImages map[string]WorkerImage `toml:"worker_images" json:"worker-images"`

	// PlatformConfigFile is the validated NDDev resource and trust policy.
	PlatformConfigFile string `toml:"platform_config_file" json:"platform-config-file"`
	// JournalFile and JournalLockFile provide cross-process admission leases.
	JournalFile     string `toml:"journal_file" json:"journal-file"`
	JournalLockFile string `toml:"journal_lock_file" json:"journal-lock-file"`
	// QueueIntentFile is the GARM-owned, fsync-published pre-AcquireJobs
	// scheduler journal. The provider is strictly a read-only consumer.
	QueueIntentFile string `toml:"queue_intent_file" json:"queue-intent-file"`
	// AdmissionLeaseSeconds bounds recovery of a crash before instance creation.
	AdmissionLeaseSeconds int `toml:"admission_lease_seconds" json:"admission-lease-seconds"`
	// PreviousProviderIdentities is deliberately bounded to N-1. Carrying an
	// open-ended allowlist would turn rolling compatibility into permanent
	// acceptance of obsolete worker policy.
	PreviousProviderIdentities []ProviderIdentity `toml:"previous_provider_identities" json:"previous-provider-identities"`
	CurrentProviderIdentity    ProviderIdentity   `toml:"current_provider_identity" json:"current-provider-identity"`
	// AllowedGitHubAccounts and AllowedGitHubRepositories are the deployment
	// boundary accepted from GARM. Public source supplies only validation and
	// synthetic examples; the private estate owns the real account identities.
	AllowedGitHubAccounts     []string `toml:"allowed_github_accounts" json:"allowed-github-accounts"`
	AllowedGitHubRepositories []string `toml:"allowed_github_repositories" json:"allowed-github-repositories"`
	WorkerGatewayURL          string   `toml:"worker_gateway_url" json:"worker-gateway-url"`

	// Diagnostics are captured outside a disposable VM immediately before
	// teardown. These pilot limits are exact so config drift cannot silently
	// expand the amount of untrusted log data retained on the host.
	DiagnosticsDirectory      string `toml:"diagnostics_directory" json:"diagnostics-directory"`
	DiagnosticsRetentionHours int    `toml:"diagnostics_retention_hours" json:"diagnostics-retention-hours"`
	DiagnosticsMaxBundleBytes int64  `toml:"diagnostics_max_bundle_bytes" json:"diagnostics-max-bundle-bytes"`
	DiagnosticsMaxTotalBytes  int64  `toml:"diagnostics_max_total_bytes" json:"diagnostics-max-total-bytes"`
}

type IncusImageRemote struct {
	Address            string              `toml:"addr" json:"addr"`
	Public             bool                `toml:"public" json:"public"`
	Protocol           IncusRemoteProtocol `toml:"protocol" json:"protocol"`
	InsecureSkipVerify bool                `toml:"skip_verify" json:"skip-verify"`
}

type IncusImageType string

type IncusRemoteProtocol string

type ProviderIdentity struct {
	Version string `toml:"version" json:"version"`
	Commit  string `toml:"commit" json:"commit"`
}

type WorkerImage struct {
	Alias               string         `toml:"alias" json:"alias"`
	Fingerprint         string         `toml:"fingerprint" json:"fingerprint"`
	PreviousFingerprint string         `toml:"previous_fingerprint" json:"previous_fingerprint,omitempty"`
	Variant             string         `toml:"variant" json:"variant"`
	InstanceType        IncusImageType `toml:"instance_type" json:"instance_type"`
	RunnerUID           int64          `toml:"runner_uid" json:"runner_uid"`
	RunnerGID           int64          `toml:"runner_gid" json:"runner_gid"`
}